Cyber war? Not possible, says a study

Notwithstanding serious concerns about cyber security across the world, a new study conducted at the Oxford Internet Institute says that a cyber war is an unlikely scenario.

Heavy lobbying, lurid language and poor analysis are inhibiting government planning for cyber protection, according to the new report on Systemic Cyber Security published by the Organisation for Economic Cooperation and Development.

The study by Dr Ian Brown of the Oxford Internet Institute, University of Oxford, and Professor Peter Sommer of the London School of Economics concludes that it is highly unlikely there will ever be a pure 'cyber war' fought solely in cyberspace with equivalent effects to recent wars in Afghanistan, the Balkans or West Asia.

. . .

The report, part of a wider OECD project on Future Global Shocks, is aimed at governments, global businesses and policy makers.

It looks at the nature of global catastrophes and then asks which possible cyber-events might create similar effects.

In addition to the actions of governments and terrorists, the study considers criminals and accidents.

There is a review of current government action, an examination of how governments interact with the private sector and a consideration of the prospects for international cooperation and treaties.

. . .

The best protections are careful system design, the use of products to detect known viruses and system intrusions and user education, says the report.

It adds that it is also essential to have proper contingency plans for system recovery, a university release said.

Brown said: "We think that a largely military approach to cyber security is a mistake. Most targets in the critical national infrastructure of communications, energy, finance, food, government, health, transport and water are in the private sector.

. . .

Because it is often difficult to be certain who is attacking you from cyberspace, defence by deterrence does not work.

"That said, cyber weaponry in all its forms will play a key role alongside more conventional and psychological attacks by nation states in future warfare."

Prof Sommer said: "We don't help ourselves using 'cyberwar' to describe espionage or hacktivist blockading or defacing of websites, as recently seen in reaction to WikiLeaks.

Nor is it helpful to group trivially avoidable incidents like routine viruses and frauds with determined attempts to disrupt critical national infrastructure."

. . .

The study says that many 'cyber' risks are real but that it is important to test each one to understand all the elements that are required before a potential threat causes real damage.

How much research is required on the target, in writing computer code that would not be detected, and how long will the event last before the attacked system is able to recover? The study says this type of careful analysis helps us understand what we should really worry about and points the way to remedies.

The UK government has announced as part of its Strategic Defence and Security Review that 650 million pounds are available to address 'cyber' attacks, seen as a Tier One threat.

. . .